Detection rules › Kusto

Mimecast Targeted Threat Protection - URL Protect

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Severity: high
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Detects malicious scan results and actions which are not allowed

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T0865` Spearphishing Attachment

Rule body

id: 9d5545bd-1450-4086-935c-62f15fc4a4c9
name: Mimecast Targeted Threat Protection - URL Protect
description: Detects malicious scan results and actions which are not allowed
severity: High
requiredDataConnectors:
  - connectorId: MimecastTTPAPI
    dataTypes:
      - MimecastTTPUrl_CL
enabled: true
query: MimecastTTPUrl_CL| where scanResult_s == "malicious" and action_s != "allow";
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- InitialAccess
- Discovery
relevantTechniques:
- T0865
alertRuleTemplateName:
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sendingIp_s
  - entityType: MailMessage
    fieldMappings:
      - identifier: Sender
        columnName: fromUserEmailAddress_s
      - identifier: InternetMessageId
        columnName: messageId_s
      - identifier: Recipient
        columnName: userEmailAddress_s
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: url_s
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

MimecastTTPUrl_CL

Stage 2: `where`

| where scanResult_s == "malicious" and action_s != "allow";

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action_s`	ne	`allow`	`field:"action_s" kind:ne value:"allow"`
`scanResult_s`	eq	`malicious`	`field:"scanResult_s" kind:eq value:"malicious"`